Reporting

Count how many days event was

Becherer
Explorer

I am looking to have a search that counts in days when the event was when a person logs in.

When a person resets a password, the dc sends the event to splunk. I am looking to have the timestamp on the event start the clock at 30 days. Every day that passes from the event timestamp of when the person reset the password, I want it to minus a day. I have played around | eval time but can't seem to get the correct search. 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you looked 

  • stats + range
  • duration
  • relative_time
  • reltime

r. Ismo

0 Karma

Becherer
Explorer

@isoutamo 

I can't say I have. Do you have any information that you could provide as good starting place, ideas on execution?

Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you give some samples of those events  (anonymise those first), so community could better help you?

r. Ismo

0 Karma

Becherer
Explorer

@isoutamo 

After doing a search, I get the following fields back.

 

Name: John Blake

passwordlastset: 8/24/2020 7:57:24 AM

epoch:1598273844

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Maybe something like this:

index=_internal | head 1
| eval _raw = "Name, passwordlastset, epoch
John Blake, 7/25/2020 7:57:24 AM, 1597273844"
| multikv forceheader=1
| rename COMMENT AS "Previous set the sample, locig below"
| eval date_a = round(strptime(passwordlastset, "%m/%d/%Y %H:%M:%S %p"))
| eval day_diff = round(time() - date_a), ds_day = tostring(day_diff, "duration")
| eval days_left = 30 - floor(day_diff / (60*60*24))
| table Name, passwordlastset, day_diff ds_day days_left

You could change floor -> ceil if this was what you are looking.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...